CVE-2023-53680

What it actually does

Out-of-bounds array access in nfsd4_decode_compound when OPDESC indexes nfsd4_ops with OP_ILLEGAL (opnum 10044), causing kernel memory read beyond array bounds and potential panic in the NFS server path.

Why it matters to the business

Remote unauthenticated attackers can crash NFS servers, disrupting file-sharing workloads and causing unplanned downtime for dependent applications and users.

How an attack unfolds

An attacker sends a crafted NFSv4 COMPOUND request containing an illegal operation number; nfsd4_decode_compound passes the value directly to OPDESC, which performs an unchecked array lookup leading to memory corruption and kernel crash.

How to fix it

Apply the upstream fix in commit 50827896c365e0f6c8b55ed56d444dafd87c92c5 or later stable kernels that contain this change; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 50827896c365e0f6c8b55ed56d444dafd87c92c5; test by sending a COMPOUND request with OP_ILLEGAL and verify the server remains stable.

Typical attack path

1. Establish network connectivity to an exposed NFSv4 service
2. Craft a COMPOUND procedure containing OP_ILLEGAL (10044)
3. Transmit the request to trigger OPDESC out-of-bounds indexing
4. Observe kernel panic or service denial on the target

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for NFS server crashes or out-of-bounds accesses immediately following unusual COMPOUND requests; correlate with network traffic showing malformed NFSv4 operations.

What your security team should do

• Prioritize patching NFS servers reachable from untrusted networks
• Restrict NFSv4 exposure using firewalls or network segmentation until patched
• Monitor kernel logs for NFS-related oops or panic messages during the rollout window